PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-5135 SonicWall CVE debrief

CVE-2020-5135 is a SonicWall SonicOS buffer overflow vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 2022-03-15. CISA’s catalog entry instructs defenders to apply updates per vendor instructions, and the remediation due date in the KEV record is 2022-04-05. Because it is on the KEV list, organizations using SonicWall SonicOS should treat it as a priority patching item and verify remediation status promptly.

Vendor
SonicWall
Product
SonicOS
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-03-15
Original CVE updated
2022-03-15
Advisory published
2022-03-15
Advisory updated
2022-03-15

Who should care

Organizations that operate SonicWall SonicOS, including security operations teams, vulnerability management teams, and system owners responsible for SonicWall appliances or deployments.

Technical summary

The official source corpus identifies the issue as a buffer overflow vulnerability in SonicWall SonicOS. CISA lists it in the KEV catalog and directs organizations to apply updates per vendor instructions. The provided sources do not include affected version ranges, exploit details, or a CVSS score, so remediation planning should rely on the vendor’s guidance and the official CVE/NVD records.

Defensive priority

Urgent. CISA placed CVE-2020-5135 in the KEV catalog on 2022-03-15 and set a remediation due date of 2022-04-05, which makes it a high-priority vulnerability for asset owners to confirm and remediate.

Recommended defensive actions

  • Identify all SonicWall SonicOS assets in your environment and confirm whether they are affected.
  • Apply vendor-recommended updates as directed by SonicWall and referenced by CISA.
  • Verify remediation before the KEV due date or as soon as operationally possible if still unpatched.
  • Use the official CVE and NVD records to confirm any additional vendor or version details.
  • Document patch status and exceptions, and retest affected assets after remediation.

Evidence notes

Evidence used here is limited to the official CISA KEV source item and the linked official CVE/NVD resources. The KEV metadata provides the vulnerability name, date added (2022-03-15), due date (2022-04-05), and required action ('Apply updates per vendor instructions.'). The source corpus does not provide exploit code, affected version ranges, or other technical specifics.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-5135 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-5135

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-5135 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-5135

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.